commit 6a14b24

libressl: Update to 4.2.1

1@@ -12,7 +12,7 @@
2 /kbd-2.4.0.tar.gz
3 /less-643.tar.gz
4 /libbluray-1.3.4.tar.bz2
5-/libressl-3.4.2.tar.gz
6+/libressl-4.2.1.tar.gz
7 /libtermkey-0.22.tar.gz
8 /linux-6.19.tar.xz
9 /lpeg-1.1.0.tar.gz

  1@@ -1,20 +1,39 @@
  2 cflags{
  3-	'-Wundef', '-Wno-attributes',
  4+	'-std=c11', '-Wall', '-Wundef', '-Wno-attributes',
  5+	'-D _DEFAULT_SOURCE',
  6 	'-D LIBRESSL_INTERNAL',
  7 	'-D OPENSSL_NO_HW_PADLOCK',
  8 	'-D OPENSSL_NO_ASM',
  9 	'-D __BEGIN_HIDDEN_DECLS=',
 10 	'-D __END_HIDDEN_DECLS=',
 11 	[[-D '__warn_references(sym,msg)=_Static_assert(1, "")']],
 12+	'-I $srcdir/crypto/hidden',
 13+	'-I $srcdir/ssl/hidden',
 14 	'-I $srcdir/include',
 15 	'-I $srcdir/crypto',
 16+	'-I $srcdir/crypto/arch/amd64',
 17+	'-I $srcdir/crypto/aes',
 18 	'-I $srcdir/crypto/asn1',
 19+	'-I $srcdir/crypto/bio',
 20 	'-I $srcdir/crypto/bn',
 21+	'-I $srcdir/crypto/bn/arch/amd64',
 22+	'-I $srcdir/crypto/bytestring',
 23+	'-I $srcdir/crypto/conf',
 24+	'-I $srcdir/crypto/curve25519',
 25+	'-I $srcdir/crypto/dh',
 26+	'-I $srcdir/crypto/dsa',
 27 	'-I $srcdir/crypto/ec',
 28-	'-I $srcdir/crypto/ecdh',
 29 	'-I $srcdir/crypto/ecdsa',
 30+	'-I $srcdir/crypto/err',
 31 	'-I $srcdir/crypto/evp',
 32+	'-I $srcdir/crypto/hmac',
 33 	'-I $srcdir/crypto/modes',
 34+	'-I $srcdir/crypto/ocsp',
 35+	'-I $srcdir/crypto/pkcs12',
 36+	'-I $srcdir/crypto/rsa',
 37+	'-I $srcdir/crypto/sha',
 38+	'-I $srcdir/crypto/stack',
 39+	'-I $srcdir/crypto/x509',
 40 	'-I $basedir/pkg/openbsd/include',
 41 	'-idirafter $srcdir/include/compat',
 42 }
 43@@ -24,6 +43,7 @@ pkg.hdrs = {
 44 		'aes.h',
 45 		'asn1.h',
 46 		'asn1t.h',
 47+		'posix_time.h',
 48 		'blowfish.h',
 49 		'bio.h',
 50 		'bn.h',
 51@@ -35,33 +55,33 @@ pkg.hdrs = {
 52 		'cms.h',
 53 		'comp.h',
 54 		'conf.h',
 55-		'conf_api.h',
 56 		'crypto.h',
 57+		'ct.h',
 58 		'curve25519.h',
 59 		'des.h',
 60 		'dh.h',
 61 		'dsa.h',
 62-		'dso.h',
 63 		'ec.h',
 64 		'ecdh.h',
 65 		'ecdsa.h',
 66 		'engine.h',
 67 		'err.h',
 68 		'evp.h',
 69-		'gost.h',
 70 		'hmac.h',
 71 		'idea.h',
 72+		'kdf.h',
 73 		'lhash.h',
 74 		'md4.h',
 75 		'md5.h',
 76+		'mlkem.h',
 77 		'modes.h',
 78 		'objects.h',
 79 		'ocsp.h',
 80+		'opensslconf.h',
 81 		'opensslfeatures.h',
 82 		'opensslv.h',
 83 		'ossl_typ.h',
 84 		'pem.h',
 85-		'pem2.h',
 86 		'pkcs12.h',
 87 		'pkcs7.h',
 88 		'poly1305.h',
 89@@ -78,215 +98,455 @@ pkg.hdrs = {
 90 		'ts.h',
 91 		'txt_db.h',
 92 		'ui.h',
 93-		'ui_compat.h',
 94-		'whrlpool.h',
 95 		'x509.h',
 96 		'x509_vfy.h',
 97-		'x509_verify.h',
 98 		'x509v3.h',
 99 
100-		'opensslconf.h',
101 		'obj_mac.h',
102 
103+		'dtls1.h',
104 		'srtp.h',
105 		'ssl.h',
106-		'ssl2.h',
107 		'ssl3.h',
108-		'ssl23.h',
109 		'tls1.h',
110-		'dtls1.h',
111 	}),
112 	install=true,
113 }
114 
115 -- src/crypto/Makefile.am
116 lib('libcrypto.a', [[crypto/(
117-	cryptlib.c malloc-wrapper.c mem_dbg.c cversion.c ex_data.c cpt_err.c
118-	o_time.c o_str.c o_init.c
119-	mem_clr.c crypto_init.c crypto_lock.c
120+	crypto_err.c
121+	crypto_ex_data.c
122+	crypto_init.c
123+	crypto_legacy.c
124+	crypto_lock.c
125+	crypto_memory.c
126+	arch/amd64/crypto_cpu_caps.c
127 	aes/(
128-		aes_misc.c aes_ecb.c aes_cfb.c aes_ofb.c
129-		aes_ctr.c aes_ige.c aes_wrap.c
130+		aes.c
131+		aes_core.c
132 	)
133 	asn1/(
134-		a_object.c a_bitstr.c a_time.c a_int.c a_octet.c
135-		a_print.c a_type.c a_dup.c a_d2i_fp.c a_i2d_fp.c
136-		a_enum.c a_utf8.c a_sign.c a_digest.c a_verify.c a_mbstr.c a_strex.c
137-		x_algor.c x_val.c x_pubkey.c x_sig.c x_req.c x_attrib.c x_bignum.c
138-		x_long.c x_name.c x_x509.c x_x509a.c x_crl.c x_info.c x_spki.c nsseq.c
139-		x_nx509.c d2i_pu.c d2i_pr.c i2d_pu.c i2d_pr.c
140-		t_req.c t_x509.c t_x509a.c t_crl.c t_pkey.c t_spki.c t_bitst.c
141-		tasn_new.c tasn_fre.c tasn_enc.c tasn_dec.c tasn_utl.c tasn_typ.c
142-		tasn_prn.c ameth_lib.c
143-		f_int.c f_string.c n_pkey.c
144-		f_enum.c x_pkey.c a_bool.c x_exten.c bio_asn1.c bio_ndef.c asn_mime.c
145-		asn1_gen.c asn1_par.c asn1_lib.c asn1_err.c a_strnid.c
146-		evp_asn1.c asn_pack.c p5_pbe.c p5_pbev2.c p8_pkey.c asn_moid.c
147+		a_bitstr.c
148+		a_enum.c
149+		a_int.c
150+		a_mbstr.c
151+		a_object.c
152+		a_octet.c
153+		a_pkey.c
154+		a_print.c
155+		a_pubkey.c
156+		a_strex.c
157+		a_string.c
158+		a_strnid.c
159+		a_time.c
160+		a_time_posix.c
161 		a_time_tm.c
162+		a_type.c
163+		a_utf8.c
164+		asn1_err.c
165+		asn1_gen.c
166+		asn1_item.c
167+		asn1_lib.c
168+		asn1_old.c
169+		asn1_old_lib.c
170+		asn1_par.c
171+		asn1_types.c
172+		asn_mime.c
173+		asn_moid.c
174+		bio_asn1.c
175+		bio_ndef.c
176+		p5_pbe.c
177+		p5_pbev2.c
178+		p8_pkey.c
179+		t_crl.c
180+		t_req.c
181+		t_spki.c
182+		t_x509.c
183+		t_x509a.c
184+		tasn_dec.c
185+		tasn_enc.c
186+		tasn_fre.c
187+		tasn_new.c
188+		tasn_prn.c
189+		tasn_typ.c
190+		tasn_utl.c
191+		x_algor.c
192+		x_attrib.c
193+		x_bignum.c
194+		x_crl.c
195+		x_exten.c
196+		x_long.c
197+		x_name.c
198+		x_pubkey.c
199+		x_req.c
200+		x_sig.c
201+		x_spki.c
202+		x_val.c
203+		x_x509.c
204+		x_x509a.c
205 	)
206-	bf/(bf_skey.c bf_ecb.c bf_cfb64.c bf_ofb64.c)
207+	bf/blowfish.c
208 	bio/(
209-		bio_lib.c bio_cb.c bio_err.c bio_meth.c
210-		bss_mem.c bss_null.c bss_fd.c
211-		bss_file.c bss_sock.c bss_conn.c
212-		bf_null.c bf_buff.c b_print.c b_dump.c
213-		b_posix.c b_sock.c bss_acpt.c bf_nbio.c bss_log.c bss_bio.c
214+		b_dump.c
215+		b_posix.c
216+		b_print.c
217+		b_sock.c
218+		bf_buff.c
219+		bf_nbio.c
220+		bf_null.c
221+		bio_cb.c
222+		bio_err.c
223+		bio_lib.c
224+		bio_meth.c
225+		bss_acpt.c
226+		bss_bio.c
227+		bss_conn.c
228 		bss_dgram.c
229+		bss_fd.c
230+		bss_file.c
231+		bss_mem.c
232+		bss_null.c
233+		bss_sock.c
234 	)
235 	bn/(
236-		bn_add.c bn_div.c bn_exp.c bn_lib.c bn_ctx.c bn_mul.c bn_mod.c
237-		bn_print.c bn_rand.c bn_shift.c bn_word.c bn_blind.c
238-		bn_kron.c bn_sqrt.c bn_gcd.c bn_prime.c bn_err.c bn_sqr.c
239-		bn_recp.c bn_mont.c bn_mpi.c bn_exp2.c bn_gf2m.c bn_nist.c
240-		bn_depr.c bn_const.c bn_x931p.c
241+		bn_add.c
242+		bn_add_sub.c
243+		bn_bpsw.c
244+		bn_const.c
245+		bn_convert.c
246+		bn_ctx.c
247+		bn_div.c
248+		bn_err.c
249+		bn_exp.c
250+		bn_gcd.c
251+		bn_isqrt.c
252+		bn_kron.c
253+		bn_lib.c
254+		bn_mod.c
255+		bn_mod_sqrt.c
256+		bn_mod_words.c
257+		bn_mont.c
258+		bn_mul.c
259+		bn_prime.c
260+		bn_primitives.c
261+		bn_print.c
262+		bn_rand.c
263+		bn_recp.c
264+		bn_shift.c
265+		bn_small_primes.c
266+		bn_sqr.c
267+		bn_word.c
268 	)
269-	buffer/(buffer.c buf_err.c buf_str.c)
270-	camellia/(cmll_cfb.c cmll_ctr.c cmll_ecb.c cmll_ofb.c)
271-	cast/(c_skey.c c_ecb.c c_enc.c c_cfb64.c c_ofb64.c)
272+	buffer/(buf_err.c buffer.c)
273+	bytestring/(bs_ber.c bs_cbb.c bs_cbs.c)
274+	camellia/camellia.c
275+	cast/cast.c
276 	chacha/chacha.c
277-	cmac/(cmac.c cm_ameth.c cm_pmeth.c)
278+	cmac/(cm_ameth.c cm_pmeth.c cmac.c)
279 	cms/(
280-		cms_asn1.c cms_att.c cms_cd.c cms_dd.c cms_enc.c cms_env.c cms_err.c
281-		cms_ess.c cms_io.c cms_kari.c cms_lib.c cms_pwri.c cms_sd.c
282+		cms_asn1.c
283+		cms_att.c
284+		cms_dd.c
285+		cms_enc.c
286+		cms_env.c
287+		cms_err.c
288+		cms_ess.c
289+		cms_io.c
290+		cms_kari.c
291+		cms_lib.c
292+		cms_pwri.c
293+		cms_sd.c
294 		cms_smime.c
295 	)
296-	comp/(comp_lib.c comp_err.c c_rle.c c_zlib.c)
297 	conf/(
298-		conf_err.c conf_lib.c conf_api.c conf_def.c conf_mod.c
299-		conf_mall.c conf_sap.c
300+		conf_api.c
301+		conf_def.c
302+		conf_err.c
303+		conf_lib.c
304+		conf_mod.c
305+		conf_sap.c
306+	)
307+	ct/(
308+		ct_b64.c
309+		ct_err.c
310+		ct_log.c
311+		ct_oct.c
312+		ct_policy.c
313+		ct_prn.c
314+		ct_sct.c
315+		ct_sct_ctx.c
316+		ct_vfy.c
317+		ct_x509v3.c
318 	)
319-	curve25519/(curve25519.c curve25519-generic.c)
320+	curve25519/(curve25519-generic.c curve25519.c)
321 	des/(
322-		cbc_cksm.c cbc_enc.c cfb64enc.c cfb_enc.c
323-		ecb3_enc.c ecb_enc.c  enc_read.c enc_writ.c
324-		fcrypt.c ofb64enc.c ofb_enc.c  pcbc_enc.c
325-		qud_cksm.c rand_key.c set_key.c xcbc_enc.c
326-		str2key.c  cfb64ede.c ofb64ede.c ede_cbcm_enc.c
327+		des.c
328+		des_cksum.c
329+		des_enc.c
330+		des_fcrypt.c
331+		des_key.c
332 	)
333 	dh/(
334-		dh_asn1.c dh_gen.c dh_key.c dh_lib.c dh_check.c dh_err.c dh_depr.c
335-		dh_ameth.c dh_pmeth.c dh_prn.c
336+		dh_ameth.c
337+		dh_asn1.c
338+		dh_check.c
339+		dh_err.c
340+		dh_gen.c
341+		dh_key.c
342+		dh_lib.c
343+		dh_pmeth.c
344 	)
345 	dsa/(
346-		dsa_gen.c dsa_key.c dsa_lib.c dsa_asn1.c dsa_vrf.c dsa_sign.c
347-		dsa_err.c dsa_ossl.c dsa_depr.c dsa_ameth.c dsa_pmeth.c dsa_prn.c
348+		dsa_ameth.c
349+		dsa_asn1.c
350+		dsa_err.c
351+		dsa_gen.c
352+		dsa_key.c
353+		dsa_lib.c
354 		dsa_meth.c
355-	)
356-	dso/(
357-		dso_dlfcn.c dso_err.c dso_lib.c dso_null.c
358-		dso_openssl.c
359+		dsa_ossl.c
360+		dsa_pmeth.c
361+		dsa_prn.c
362 	)
363 	ec/(
364-		ec_lib.c ecp_smpl.c ecp_mont.c ecp_nist.c ec_cvt.c ec_mult.c
365-		ec_err.c ec_curve.c ec_check.c ec_print.c ec_asn1.c ec_key.c
366-		ec2_smpl.c ec2_mult.c ec_ameth.c ec_pmeth.c ec_kmeth.c eck_prn.c
367-		ecp_oct.c ec2_oct.c ec_oct.c
368-	)
369-	ecdh/(ech_lib.c ech_key.c ech_err.c ecdh_kdf.c)
370-	ecdsa/(ecs_lib.c ecs_asn1.c ecs_ossl.c ecs_sign.c ecs_vrf.c ecs_err.c)
371-	engine/(
372-		eng_err.c eng_lib.c eng_list.c eng_init.c eng_ctrl.c
373-		eng_table.c eng_pkey.c eng_fat.c eng_all.c
374-		tb_rsa.c tb_dsa.c tb_ecdsa.c tb_dh.c tb_ecdh.c tb_rand.c tb_store.c
375-		tb_cipher.c tb_digest.c tb_pkmeth.c tb_asnmth.c tb_eckey.c
376-		eng_openssl.c eng_cnf.c eng_dyn.c
377+		ec_ameth.c
378+		ec_asn1.c
379+		ec_convert.c
380+		ec_curve.c
381+		ec_err.c
382+		ec_field.c
383+		ec_key.c
384+		ec_lib.c
385+		ec_mult.c
386+		ec_pmeth.c
387+		eck_prn.c
388+		ecp_hp_methods.c
389+		ecp_methods.c
390+		ecx_methods.c
391 	)
392+	ecdh/ecdh.c
393+	ecdsa/ecdsa.c
394+	engine/engine_stubs.c
395 	err/(err.c err_all.c err_prn.c)
396 	evp/(
397-		encode.c digest.c evp_enc.c evp_key.c
398-		e_des.c e_bf.c e_idea.c e_des3.c e_camellia.c
399-		e_rc4.c e_aes.c names.c
400-		e_xcbc_d.c e_rc2.c e_cast.c
401-		m_null.c m_md4.c m_md5.c m_sha1.c m_sm3.c m_wp.c
402-		m_dss.c m_dss1.c m_ripemd.c m_ecdsa.c
403-		p_open.c p_seal.c p_sign.c p_verify.c p_lib.c p_enc.c p_dec.c
404-		bio_md.c bio_b64.c bio_enc.c evp_err.c e_null.c
405-		c_all.c evp_lib.c
406-		evp_pkey.c evp_pbe.c p5_crpt.c p5_crpt2.c
407-		e_old.c pmeth_lib.c pmeth_fn.c pmeth_gn.c m_sigver.c
408-		e_aes_cbc_hmac_sha1.c e_rc4_hmac_md5.c
409-		e_chacha.c evp_aead.c e_chacha20poly1305.c
410-		e_gost2814789.c m_gost2814789.c m_gostr341194.c m_streebog.c
411+		bio_b64.c
412+		bio_enc.c
413+		bio_md.c
414+		e_aes.c
415+		e_bf.c
416+		e_camellia.c
417+		e_cast.c
418+		e_chacha.c
419+		e_chacha20poly1305.c
420+		e_des.c
421+		e_des3.c
422+		e_idea.c
423+		e_null.c
424+		e_rc2.c
425+		e_rc4.c
426 		e_sm4.c
427+		e_xcbc_d.c
428+		evp_aead.c
429+		evp_cipher.c
430+		evp_digest.c
431+		evp_encode.c
432+		evp_err.c
433+		evp_key.c
434+		evp_names.c
435+		evp_pbe.c
436+		evp_pkey.c
437+		m_md4.c
438+		m_md5.c
439 		m_md5_sha1.c
440-	)
441-	gost/(
442-		gost2814789.c gost89_keywrap.c gost89_params.c gost89imit_ameth.c
443-		gost89imit_pmeth.c gost_asn1.c gost_err.c gostr341001.c
444-		gostr341001_ameth.c gostr341001_key.c gostr341001_params.c
445-		gostr341001_pmeth.c gostr341194.c streebog.c
446+		m_null.c
447+		m_ripemd.c
448+		m_sha1.c
449+		m_sha3.c
450+		m_sigver.c
451+		m_sm3.c
452+		p_legacy.c
453+		p_lib.c
454+		p_sign.c
455+		p_verify.c
456+		pmeth_fn.c
457+		pmeth_gn.c
458+		pmeth_lib.c
459 	)
460 	hkdf/hkdf.c
461-	hmac/(hmac.c hm_ameth.c hm_pmeth.c)
462-	idea/(i_cbc.c i_cfb64.c i_ofb64.c i_ecb.c i_skey.c)
463-	lhash/(lhash.c lh_stats.c)
464-	md4/(md4_dgst.c md4_one.c)
465-	md5/(md5_dgst.c md5_one.c)
466-	modes/(cbc128.c ctr128.c cts128.c cfb128.c ofb128.c gcm128.c ccm128.c xts128.c)
467-	objects/(o_names.c obj_dat.c obj_lib.c obj_err.c obj_xref.c)
468+	hmac/(hm_ameth.c hm_pmeth.c hmac.c)
469+	idea/idea.c
470+	kdf/(hkdf_evp.c kdf_err.c tls1_prf.c)
471+	lhash/lhash.c
472+	md4/md4.c
473+	md5/md5.c
474+	mlkem/(mlkem.c mlkem_internal.c mlkem_key.c)
475+	modes/(
476+		cbc128.c
477+		ccm128.c
478+		cfb128.c
479+		ctr128.c
480+		gcm128.c
481+		ofb128.c
482+		xts128.c
483+	)
484+	objects/(
485+		obj_dat.c
486+		obj_err.c
487+		obj_lib.c
488+		obj_xref.c
489+	)
490 	ocsp/(
491-		ocsp_asn.c ocsp_ext.c ocsp_ht.c ocsp_lib.c ocsp_cl.c
492-		ocsp_srv.c ocsp_prn.c ocsp_vfy.c ocsp_err.c
493+		ocsp_asn.c
494+		ocsp_cl.c
495+		ocsp_err.c
496+		ocsp_ext.c
497+		ocsp_ht.c
498+		ocsp_lib.c
499+		ocsp_prn.c
500+		ocsp_srv.c
501+		ocsp_vfy.c
502 	)
503 	pem/(
504-		pem_sign.c pem_seal.c pem_info.c pem_lib.c pem_all.c pem_err.c
505-		pem_x509.c pem_xaux.c pem_oth.c pem_pk8.c pem_pkey.c pvkfmt.c
506+		pem_all.c
507+		pem_err.c
508+		pem_info.c
509+		pem_lib.c
510+		pem_oth.c
511+		pem_pk8.c
512+		pem_pkey.c
513+		pem_sign.c
514+		pem_x509.c
515+		pem_xaux.c
516+		pvkfmt.c
517 	)
518 	pkcs12/(
519-		p12_add.c p12_asn.c p12_attr.c p12_crpt.c p12_crt.c p12_decr.c
520-		p12_init.c p12_key.c p12_kiss.c p12_mutl.c
521-		p12_utl.c p12_npas.c pk12err.c p12_p8d.c p12_p8e.c
522+		p12_add.c
523+		p12_asn.c
524+		p12_attr.c
525+		p12_crt.c
526+		p12_decr.c
527+		p12_init.c
528+		p12_key.c
529+		p12_kiss.c
530+		p12_mutl.c
531+		p12_npas.c
532+		p12_p8d.c
533+		p12_p8e.c
534+		p12_sbag.c
535+		p12_utl.c
536+		pk12err.c
537 	)
538 	pkcs7/(
539-		pk7_asn1.c pk7_lib.c pkcs7err.c pk7_doit.c pk7_smime.c pk7_attr.c
540-		pk7_mime.c bio_pk7.c
541+		pk7_asn1.c
542+		pk7_attr.c
543+		pk7_doit.c
544+		pk7_lib.c
545+		pk7_mime.c
546+		pk7_smime.c
547+		pkcs7err.c
548 	)
549 	poly1305/poly1305.c
550-	rand/(randfile.c rand_lib.c rand_err.c)
551-	rc2/(rc2_ecb.c rc2_skey.c rc2_cbc.c rc2cfb64.c rc2ofb64.c)
552-	ripemd/(rmd_dgst.c rmd_one.c)
553+	rand/(rand_err.c rand_lib.c randfile.c)
554+	rc2/rc2.c
555+	rc4/rc4.c
556+	ripemd/ripemd.c
557 	rsa/(
558-		rsa_eay.c rsa_gen.c rsa_lib.c rsa_sign.c rsa_saos.c rsa_err.c
559-		rsa_pk1.c rsa_none.c rsa_oaep.c rsa_chk.c
560-		rsa_pss.c rsa_x931.c rsa_asn1.c rsa_depr.c rsa_ameth.c rsa_prn.c
561-		rsa_pmeth.c rsa_crpt.c rsa_meth.c
562+		rsa_ameth.c
563+		rsa_asn1.c
564+		rsa_blinding.c
565+		rsa_chk.c
566+		rsa_eay.c
567+		rsa_err.c
568+		rsa_gen.c
569+		rsa_lib.c
570+		rsa_meth.c
571+		rsa_none.c
572+		rsa_oaep.c
573+		rsa_pk1.c
574+		rsa_pmeth.c
575+		rsa_prn.c
576+		rsa_pss.c
577+		rsa_saos.c
578+		rsa_sign.c
579+		rsa_x931.c
580 	)
581-	sha/(sha1dgst.c sha1_one.c sha256.c sha512.c)
582+	sha/(sha1.c sha256.c sha3.c sha512.c)
583 	sm3/sm3.c
584 	sm4/sm4.c
585 	stack/stack.c
586 	ts/(
587-		ts_err.c ts_req_utils.c ts_req_print.c ts_rsp_utils.c ts_rsp_print.c
588-		ts_rsp_sign.c ts_rsp_verify.c ts_verify_ctx.c ts_lib.c ts_conf.c
589 		ts_asn1.c
590+		ts_conf.c
591+		ts_err.c
592+		ts_lib.c
593+		ts_req_print.c
594+		ts_req_utils.c
595+		ts_rsp_print.c
596+		ts_rsp_sign.c
597+		ts_rsp_utils.c
598+		ts_rsp_verify.c
599+		ts_verify_ctx.c
600 	)
601 	txt_db/txt_db.c
602-	ui/(ui_err.c ui_lib.c ui_openssl.c ui_util.c)
603-	whrlpool/wp_dgst.c
604+	ui/(ui_err.c ui_lib.c ui_null.c ui_openssl.c)
605 	x509/(
606-		x509_addr.c x509_asid.c
607-		x509_def.c x509_d2.c x509_r2x.c x509_cmp.c
608-		x509_obj.c x509_req.c x509spki.c x509_vfy.c
609-		x509_set.c x509cset.c x509rset.c x509_err.c
610-		x509name.c x509_v3.c x509_ext.c x509_att.c
611-		x509type.c x509_lu.c x_all.c x509_txt.c
612-		x509_trs.c by_file.c by_dir.c by_mem.c x509_vpm.c
613-
614-		x509_bcons.c x509_bitst.c x509_conf.c x509_extku.c x509_ia5.c x509_lib.c
615-		x509_prn.c x509_utl.c x509_genn.c x509_alt.c x509_skey.c x509_akey.c x509_pku.c
616-		x509_int.c x509_enum.c x509_sxnet.c x509_cpols.c x509_crld.c x509_purp.c x509_info.c
617-		x509_ocsp.c x509_akeya.c x509_pmaps.c x509_pcons.c x509_ncons.c x509_pcia.c x509_pci.c
618-		x509_issuer_cache.c x509_constraints.c x509_verify.c
619-		pcy_cache.c pcy_node.c pcy_data.c pcy_map.c pcy_tree.c pcy_lib.c
620+		by_dir.c
621+		by_file.c
622+		by_mem.c
623+		x509_addr.c
624+		x509_akey.c
625+		x509_akeya.c
626+		x509_alt.c
627+		x509_asid.c
628+		x509_att.c
629+		x509_bcons.c
630+		x509_bitst.c
631+		x509_cmp.c
632+		x509_conf.c
633+		x509_constraints.c
634+		x509_cpols.c
635+		x509_crld.c
636+		x509_d2.c
637+		x509_def.c
638+		x509_err.c
639+		x509_ext.c
640+		x509_extku.c
641+		x509_genn.c
642+		x509_ia5.c
643+		x509_info.c
644+		x509_int.c
645+		x509_issuer_cache.c
646+		x509_lib.c
647+		x509_lu.c
648+		x509_ncons.c
649+		x509_obj.c
650+		x509_ocsp.c
651+		x509_pcons.c
652+		x509_pku.c
653+		x509_pmaps.c
654+		x509_policy.c
655+		x509_prn.c
656+		x509_purp.c
657+		x509_r2x.c
658+		x509_req.c
659+		x509_set.c
660+		x509_siginfo.c
661+		x509_skey.c
662+		x509_trs.c
663+		x509_txt.c
664+		x509_utl.c
665+		x509_v3.c
666+		x509_verify.c
667+		x509_vfy.c
668+		x509_vpm.c
669+		x509cset.c
670+		x509name.c
671+		x509rset.c
672+		x509spki.c
673+		x509type.c
674+		x_all.c
675 	)
676-
677-	aes/(aes_core.c aes_cbc.c)
678-	bf/bf_enc.c
679-	bn/bn_asm.c
680-	camellia/(camellia.c cmll_cbc.c cmll_misc.c)
681-	des/(des_enc.c fcrypt_b.c)
682-	rc4/(rc4_enc.c rc4_skey.c)
683-	whrlpool/wp_block.c
684 ) $builddir/pkg/openbsd/libbsd.a.d]])
685 file('lib/libcrypto.a', '644', '$outdir/libcrypto.a')
686 
687@@ -303,7 +563,6 @@ lib('libssl.a', [[ssl/(
688 	pqueue.c
689 	s3_cbc.c
690 	s3_lib.c
691-	ssl_algs.c
692 	ssl_asn1.c
693 	ssl_both.c
694 	ssl_cert.c
695@@ -318,6 +577,7 @@ lib('libssl.a', [[ssl/(
696 	ssl_packet.c
697 	ssl_pkt.c
698 	ssl_rsa.c
699+	ssl_seclevel.c
700 	ssl_sess.c
701 	ssl_sigalgs.c
702 	ssl_srvr.c
703@@ -331,29 +591,31 @@ lib('libssl.a', [[ssl/(
704 	tls12_key_schedule.c
705 	tls12_lib.c
706 	tls12_record_layer.c
707-	tls13_buffer.c
708 	tls13_client.c
709 	tls13_error.c
710 	tls13_handshake.c
711 	tls13_handshake_msg.c
712 	tls13_key_schedule.c
713-	tls13_key_share.c
714 	tls13_legacy.c
715 	tls13_lib.c
716+	tls13_quic.c
717 	tls13_record.c
718 	tls13_record_layer.c
719 	tls13_server.c
720+	tls_buffer.c
721 	tls_content.c
722+	tls_key_share.c
723+	tls_lib.c
724 ) libcrypto.a.d]])
725 file('lib/libssl.a', '644', '$outdir/libssl.a')
726 
727 exe('openssl', [[apps/openssl/(
728 	apps.c apps_posix.c asn1pars.c ca.c certhash.c ciphers.c cms.c crl.c
729 	crl2p7.c dgst.c dh.c dhparam.c dsa.c dsaparam.c ec.c ecparam.c enc.c
730-	errstr.c gendh.c gendsa.c genpkey.c genrsa.c nseq.c ocsp.c
731+	errstr.c gendh.c gendsa.c genpkey.c genrsa.c ocsp.c
732 	openssl.c passwd.c pkcs12.c pkcs7.c pkcs8.c pkey.c pkeyparam.c
733 	pkeyutl.c prime.c rand.c req.c rsa.c rsautl.c s_cb.c s_client.c
734-	s_server.c s_socket.c s_time.c sess_id.c smime.c speed.c spkac.c ts.c
735+	s_server.c s_socket.c s_time.c sess_id.c smime.c speed.c ts.c
736 	verify.c version.c x509.c
737 ) libssl.a.d libcrypto.a.d]])
738 file('bin/openssl', '755', '$outdir/openssl')

 1@@ -1,4 +1,4 @@
 2-From a16c45e3c7b271fb74a83d84e83189858b9b88bb Mon Sep 17 00:00:00 2001
 3+From 08eee219f4fa095dcafdea8b0d8eee6da8fe87db Mon Sep 17 00:00:00 2001
 4 From: Michael Forney <mforney@mforney.org>
 5 Date: Wed, 24 Apr 2019 00:07:34 -0700
 6 Subject: [PATCH] Use plain vsyslog for OPENSSL_showfatal
 7@@ -6,14 +6,14 @@ Subject: [PATCH] Use plain vsyslog for OPENSSL_showfatal
 8 The compat version just ignores the second argument anyway, and
 9 patching it out allows us to continue to ignore the compat functions.
10 ---
11- crypto/cryptlib.c | 3 +--
12+ crypto/crypto_legacy.c | 3 +--
13  1 file changed, 1 insertion(+), 2 deletions(-)
14 
15-diff --git a/crypto/cryptlib.c b/crypto/cryptlib.c
16-index 38d31e7ac..d6eface9b 100644
17---- a/crypto/cryptlib.c
18-+++ b/crypto/cryptlib.c
19-@@ -345,11 +345,10 @@ OPENSSL_cpuid_setup(void)
20+diff --git a/crypto/crypto_legacy.c b/crypto/crypto_legacy.c
21+index dcaa632..3c63111 100644
22+--- a/crypto/crypto_legacy.c
23++++ b/crypto/crypto_legacy.c
24+@@ -316,11 +316,10 @@ LCRYPTO_ALIAS(OPENSSL_cpu_caps);
25  static void
26  OPENSSL_showfatal(const char *fmta, ...)
27  {
28@@ -21,11 +21,11 @@ index 38d31e7ac..d6eface9b 100644
29  	va_list ap;
30  
31  	va_start(ap, fmta);
32--	vsyslog_r(LOG_INFO|LOG_LOCAL2, &sdata, fmta, ap);
33-+	vsyslog(LOG_INFO|LOG_LOCAL2, fmta, ap);
34+-	vsyslog_r(LOG_CONS|LOG_LOCAL2, &sdata, fmta, ap);
35++	vsyslog(LOG_CONS|LOG_LOCAL2, fmta, ap);
36  	va_end(ap);
37  }
38  
39 -- 
40-2.21.0
41+2.49.0
42 

 1@@ -1,4 +1,4 @@
 2-From adc84eef824bd6d685848965bc1271272a723727 Mon Sep 17 00:00:00 2001
 3+From fee3065756fb041241389e49991454ec62cc3d47 Mon Sep 17 00:00:00 2001
 4 From: Michael Forney <mforney@mforney.org>
 5 Date: Fri, 30 Apr 2021 18:14:07 -0700
 6 Subject: [PATCH] Remove unneeded ';' at top level
 7@@ -6,10 +6,11 @@ Subject: [PATCH] Remove unneeded ';' at top level
 8 This is not allowed in the ISO C grammar.
 9 ---
10  crypto/x509/x509_issuer_cache.c | 4 ++--
11- 1 file changed, 2 insertions(+), 2 deletions(-)
12+ crypto/x509/x509_lib.c          | 2 +-
13+ 2 files changed, 3 insertions(+), 3 deletions(-)
14 
15 diff --git a/crypto/x509/x509_issuer_cache.c b/crypto/x509/x509_issuer_cache.c
16-index 26cde17..d1af24a 100644
17+index 070e85b..12afd6d 100644
18 --- a/crypto/x509/x509_issuer_cache.c
19 +++ b/crypto/x509/x509_issuer_cache.c
20 @@ -53,8 +53,8 @@ static TAILQ_HEAD(lruqueue, x509_issuer) x509_issuer_lru =
21@@ -23,6 +24,19 @@ index 26cde17..d1af24a 100644
22  
23  /*
24   * Set the maximum number of cached entries. On additions to the cache
25+diff --git a/crypto/x509/x509_lib.c b/crypto/x509/x509_lib.c
26+index 0285ac0..d5f07e0 100644
27+--- a/crypto/x509/x509_lib.c
28++++ b/crypto/x509/x509_lib.c
29+@@ -162,7 +162,7 @@ X509V3_EXT_get_nid(int nid)
30+ 	default:
31+ 		return NULL;
32+ 	}
33+-};
34++}
35+ LCRYPTO_ALIAS(X509V3_EXT_get_nid);
36+ 
37+ const X509V3_EXT_METHOD *
38 -- 
39-2.31.1
40+2.49.0
41 

 1@@ -0,0 +1,53 @@
 2+From 20e0b159b36aabcdd7b33c07f8a20b4dd9c2a25f Mon Sep 17 00:00:00 2001
 3+From: Michael Forney <mforney@mforney.org>
 4+Date: Thu, 2 Apr 2026 23:45:13 -0700
 5+Subject: [PATCH] Use _Static_assert instead of asm("") for empty declaration
 6+
 7+Also, use the same technique for LCRYPTO_USED.
 8+---
 9+ crypto/hidden/crypto_namespace.h | 6 +++---
10+ ssl/hidden/ssl_namespace.h       | 4 ++--
11+ 2 files changed, 5 insertions(+), 5 deletions(-)
12+
13+diff --git a/crypto/hidden/crypto_namespace.h b/crypto/hidden/crypto_namespace.h
14+index 43c8718..4ad8ce0 100644
15+--- a/crypto/hidden/crypto_namespace.h
16++++ b/crypto/hidden/crypto_namespace.h
17+@@ -42,13 +42,13 @@
18+ #  define LCRYPTO_USED(x)	typeof(x) x asm("_libre_"#x)
19+ #endif
20+ #else
21+-# define LCRYPTO_UNUSED(x)
22+-# define LCRYPTO_USED(x)
23++# define LCRYPTO_UNUSED(x)	_Static_assert(1, "")
24++# define LCRYPTO_USED(x)	_Static_assert(1, "")
25+ # define LCRYPTO_ALIAS1(pre,x)
26+ #ifdef _MSC_VER
27+ # define LCRYPTO_ALIAS(x)
28+ #else
29+-# define LCRYPTO_ALIAS(x)	asm("")
30++# define LCRYPTO_ALIAS(x)	_Static_assert(1, "")
31+ #endif /* _MSC_VER */
32+ #endif
33+ 
34+diff --git a/ssl/hidden/ssl_namespace.h b/ssl/hidden/ssl_namespace.h
35+index 763dcd7..d48c95e 100644
36+--- a/ssl/hidden/ssl_namespace.h
37++++ b/ssl/hidden/ssl_namespace.h
38+@@ -34,11 +34,11 @@
39+ #endif
40+ #else
41+ #define LSSL_UNUSED(x)
42+-#define LSSL_USED(x)
43++#define LSSL_USED(x)		_Static_assert(1, "")
44+ #ifdef _MSC_VER
45+ #define LSSL_ALIAS(x)
46+ #else
47+-#define LSSL_ALIAS(x)		asm("")
48++#define LSSL_ALIAS(x)		_Static_assert(1, "")
49+ #endif /* _MSC_VER */
50+ #endif
51+ 
52+-- 
53+2.49.0
54+

  1@@ -0,0 +1,919 @@
  2+From 89e3854e0e38996edb165111a24b1bf498b392dc Mon Sep 17 00:00:00 2001
  3+From: Michael Forney <mforney@mforney.org>
  4+Date: Thu, 2 Apr 2026 23:52:53 -0700
  5+Subject: [PATCH] Avoid implicit pointer sign conversions
  6+
  7+s_client_options:
  8+All option values for clr and off used here fit in a 32-bit int,
  9+the largest being SSL_OP_NO_TLSv1_3=0x20000000L, so make these
 10+fields int.
 11+
 12+sm4_ctr_cipher:
 13+CRYPTO_ctr128_encrypt expects an unsigned int *, but ctx->num is
 14+an int. Use a local variable with the correct type to avoid aliasing
 15+issues.
 16+
 17+addr_validate_path_internal:
 18+length is used twice, its address is passed to
 19+IPAddressFamily_afi_length, expecting an int *, and addr_contains, also
 20+expecting int, so change its type to int.
 21+
 22+tls_decrypt_ticket:
 23+hlen is used for the result of HMAC_size. Though the manual documents
 24+this as returning a size_t, it actually returns an int since it
 25+wraps EVP_MD_size, which can return a negative value. HMAC_Final
 26+expects an unsigned int *, so we need a separate variable for the
 27+final length.
 28+
 29+tls13_new_session_ticket_recv:
 30+session_id_length is used twice, its address is passed to EVP_Digest
 31+which expects an unsigned int, and then it is saved in
 32+SSL_SESSION.session_id_length, a size_t. So its type from int to
 33+unsigned int.
 34+
 35+All other changes simply make explicit the conversions among pointers
 36+to character types already being done. These implicit conversions
 37+are constraint violations in ISO C.
 38+---
 39+ apps/openssl/ca.c              |  6 +++---
 40+ apps/openssl/cms.c             |  2 +-
 41+ apps/openssl/s_client.c        |  4 ++--
 42+ crypto/asn1/a_object.c         | 12 ++++++------
 43+ crypto/asn1/a_time.c           |  2 +-
 44+ crypto/asn1/a_time_tm.c        | 22 ++++++++++++----------
 45+ crypto/bio/b_dump.c            |  2 +-
 46+ crypto/bio/bss_mem.c           |  4 ++--
 47+ crypto/bn/bn_convert.c         |  8 ++++----
 48+ crypto/bn/bn_print.c           |  2 +-
 49+ crypto/evp/e_sm4.c             |  4 +++-
 50+ crypto/ocsp/ocsp_cl.c          |  4 ++--
 51+ crypto/pkcs7/pk7_attr.c        |  2 +-
 52+ crypto/x509/x509_addr.c        |  2 +-
 53+ crypto/x509/x509_constraints.c | 18 +++++++++---------
 54+ crypto/x509/x509_obj.c         | 10 +++++-----
 55+ crypto/x509/x509_utl.c         |  8 ++++----
 56+ crypto/x509/x509_verify.c      |  3 ++-
 57+ crypto/x509/x509name.c         |  3 ++-
 58+ ssl/s3_lib.c                   |  2 +-
 59+ ssl/ssl_clnt.c                 |  2 +-
 60+ ssl/ssl_lib.c                  |  8 ++++----
 61+ ssl/ssl_srvr.c                 |  2 +-
 62+ ssl/ssl_tlsext.c               |  3 ++-
 63+ ssl/ssl_txt.c                  |  4 ++--
 64+ ssl/t1_lib.c                   |  4 +++-
 65+ ssl/tls13_client.c             |  8 ++++----
 66+ ssl/tls13_key_schedule.c       | 12 ++++++------
 67+ ssl/tls13_legacy.c             |  2 +-
 68+ ssl/tls13_lib.c                |  3 ++-
 69+ ssl/tls13_record_layer.c       |  2 +-
 70+ ssl/tls13_server.c             | 10 +++++-----
 71+ 32 files changed, 95 insertions(+), 85 deletions(-)
 72+
 73+diff --git a/apps/openssl/ca.c b/apps/openssl/ca.c
 74+index b644b74..0d78f63 100644
 75+--- a/apps/openssl/ca.c
 76++++ b/apps/openssl/ca.c
 77+@@ -2153,7 +2153,7 @@ do_body(X509 **xret, EVP_PKEY *pkey, X509 *x509, const EVP_MD *dgst,
 78+ 
 79+ 	if ((tm = X509_get_notAfter(ret)) == NULL)
 80+ 		goto err;
 81+-	row[DB_exp_date] = strndup(tm->data, tm->length);
 82++	row[DB_exp_date] = strndup((char *)tm->data, tm->length);
 83+ 	if (row[DB_type] == NULL || row[DB_exp_date] == NULL) {
 84+ 		BIO_printf(bio_err, "Memory allocation failure\n");
 85+ 		goto err;
 86+@@ -2280,7 +2280,7 @@ do_revoke(X509 *x509, CA_DB *db, int type, char *value)
 87+ 
 88+ 		if ((tm = X509_get_notAfter(x509)) == NULL)
 89+ 			goto err;
 90+-		row[DB_exp_date] = strndup(tm->data, tm->length);
 91++		row[DB_exp_date] = strndup((char *)tm->data, tm->length);
 92+ 		if (row[DB_type] == NULL || row[DB_exp_date] == NULL) {
 93+ 			BIO_printf(bio_err, "Memory allocation failure\n");
 94+ 			goto err;
 95+@@ -2443,7 +2443,7 @@ do_updatedb(CA_DB *db)
 96+ 		cnt = -1;
 97+ 		goto err;
 98+ 	}
 99+-	a_tm_s = strndup(a_tm->data, a_tm->length);
100++	a_tm_s = strndup((char *)a_tm->data, a_tm->length);
101+ 	if (a_tm_s == NULL) {
102+ 		cnt = -1;
103+ 		goto err;
104+diff --git a/apps/openssl/cms.c b/apps/openssl/cms.c
105+index 458ddb0..26197ea 100644
106+--- a/apps/openssl/cms.c
107++++ b/apps/openssl/cms.c
108+@@ -1530,7 +1530,7 @@ cms_main(int argc, char **argv)
109+ 			cfg.secret_keyid = NULL;
110+ 		}
111+ 		if (cfg.pwri_pass != NULL) {
112+-			pwri_tmp = strdup(cfg.pwri_pass);
113++			pwri_tmp = (unsigned char *)strdup((char *)cfg.pwri_pass);
114+ 			if (pwri_tmp == NULL)
115+ 				goto end;
116+ 			if (CMS_add0_recipient_password(cms, -1, NID_undef,
117+diff --git a/apps/openssl/s_client.c b/apps/openssl/s_client.c
118+index 84718c1..90c203e 100644
119+--- a/apps/openssl/s_client.c
120++++ b/apps/openssl/s_client.c
121+@@ -193,7 +193,7 @@ static struct {
122+ 	char *cert_file;
123+ 	int cert_format;
124+ 	char *cipher;
125+-	unsigned int clr;
126++	int clr;
127+ 	char *connect;
128+ 	int crlf;
129+ 	int debug;
130+@@ -214,7 +214,7 @@ static struct {
131+ 	int nbio_test;
132+ 	int no_servername;
133+ 	char *npn_in;
134+-	unsigned int off;
135++	int off;
136+ 	char *passarg;
137+ 	int peekaboo;
138+ 	char *port;
139+diff --git a/crypto/asn1/a_object.c b/crypto/asn1/a_object.c
140+index 333ac60..25e7a2a 100644
141+--- a/crypto/asn1/a_object.c
142++++ b/crypto/asn1/a_object.c
143+@@ -182,7 +182,7 @@ oid_add_arc_txt(CBB *cbb, uint64_t arc, int first)
144+ 	n = snprintf(s, sizeof(s), fmt, (unsigned long long)arc);
145+ 	if (n < 0 || (size_t)n >= sizeof(s))
146+ 		return 0;
147+-	if (!CBB_add_bytes(cbb, s, n))
148++	if (!CBB_add_bytes(cbb, (uint8_t *)s, n))
149+ 		return 0;
150+ 
151+ 	return 1;
152+@@ -343,7 +343,7 @@ a2d_ASN1_OBJECT(unsigned char *out, int out_len, const char *in, int in_len)
153+ 	if (in_len <= 0)
154+ 		goto err;
155+ 
156+-	CBS_init(&cbs, in, in_len);
157++	CBS_init(&cbs, (uint8_t *)in, in_len);
158+ 
159+ 	if (!CBB_init(&cbb, 0))
160+ 		goto err;
161+@@ -401,7 +401,7 @@ i2t_ASN1_OBJECT_name(const ASN1_OBJECT *aobj, CBB *cbb, const char **out_name)
162+ 
163+ 	*out_name = name;
164+ 
165+-	if (!CBB_add_bytes(cbb, name, strlen(name)))
166++	if (!CBB_add_bytes(cbb, (uint8_t *)name, strlen(name)))
167+ 		return 0;
168+ 
169+ 	/* NUL terminate. */
170+@@ -448,7 +448,7 @@ i2t_ASN1_OBJECT_internal(const ASN1_OBJECT *aobj, char *buf, int buf_len, int no
171+ 	if (!CBB_finish(&cbb, &data, &data_len))
172+ 		goto err;
173+ 
174+-	ret = strlcpy(buf, data, buf_len);
175++	ret = strlcpy(buf, (char *)data, buf_len);
176+  err:
177+ 	CBB_cleanup(&cbb);
178+ 	free(data);
179+@@ -474,7 +474,7 @@ t2i_ASN1_OBJECT_internal(const char *oid)
180+ 
181+ 	memset(&cbb, 0, sizeof(cbb));
182+ 
183+-	CBS_init(&cbs, oid, strlen(oid));
184++	CBS_init(&cbs, (uint8_t *)oid, strlen(oid));
185+ 
186+ 	if (!CBB_init(&cbb, 0))
187+ 		goto err;
188+@@ -521,7 +521,7 @@ i2a_ASN1_OBJECT(BIO *bp, const ASN1_OBJECT *aobj)
189+ 	if (!CBB_finish(&cbb, &data, &data_len))
190+ 		goto err;
191+ 
192+-	ret = BIO_write(bp, data, strlen(data));
193++	ret = BIO_write(bp, data, strlen((char *)data));
194+ 
195+  err:
196+ 	CBB_cleanup(&cbb);
197+diff --git a/crypto/asn1/a_time.c b/crypto/asn1/a_time.c
198+index 3deff56..10634c0 100644
199+--- a/crypto/asn1/a_time.c
200++++ b/crypto/asn1/a_time.c
201+@@ -99,7 +99,7 @@ ASN1_TIME_to_tm(const ASN1_TIME *s, struct tm *tm)
202+ 	time_t now;
203+ 
204+ 	if (s != NULL)
205+-		return ASN1_time_parse(s->data, s->length, tm, 0) != -1;
206++		return ASN1_time_parse((char *)s->data, s->length, tm, 0) != -1;
207+ 
208+ 	time(&now);
209+ 	memset(tm, 0, sizeof(*tm));
210+diff --git a/crypto/asn1/a_time_tm.c b/crypto/asn1/a_time_tm.c
211+index dd28931..c0e0d62 100644
212+--- a/crypto/asn1/a_time_tm.c
213++++ b/crypto/asn1/a_time_tm.c
214+@@ -96,7 +96,7 @@ tm_to_gentime(struct tm *tm, ASN1_TIME *atime)
215+ 	}
216+ 
217+ 	free(atime->data);
218+-	atime->data = time_str;
219++	atime->data = (unsigned char *)time_str;
220+ 	atime->length = GENTIME_LENGTH;
221+ 	atime->type = V_ASN1_GENERALIZEDTIME;
222+ 
223+@@ -122,7 +122,7 @@ tm_to_utctime(struct tm *tm, ASN1_TIME *atime)
224+ 	}
225+ 
226+ 	free(atime->data);
227+-	atime->data = time_str;
228++	atime->data = (unsigned char *)time_str;
229+ 	atime->length = UTCTIME_LENGTH;
230+ 	atime->type = V_ASN1_UTCTIME;
231+ 
232+@@ -293,7 +293,7 @@ ASN1_time_parse(const char *bytes, size_t len, struct tm *tm, int mode)
233+ 	if (bytes == NULL)
234+ 		return -1;
235+ 
236+-	CBS_init(&cbs, bytes, len);
237++	CBS_init(&cbs, (uint8_t *)bytes, len);
238+ 
239+ 	if (CBS_len(&cbs) == UTCTIME_LENGTH)
240+ 		type = V_ASN1_UTCTIME;
241+@@ -401,7 +401,8 @@ ASN1_TIME_check(const ASN1_TIME *t)
242+ {
243+ 	if (t->type != V_ASN1_GENERALIZEDTIME && t->type != V_ASN1_UTCTIME)
244+ 		return 0;
245+-	return t->type == ASN1_time_parse(t->data, t->length, NULL, t->type);
246++	return t->type == ASN1_time_parse((char *)t->data, t->length, NULL,
247++	   t->type);
248+ }
249+ LCRYPTO_ALIAS(ASN1_TIME_check);
250+ 
251+@@ -414,7 +415,7 @@ ASN1_TIME_to_generalizedtime(const ASN1_TIME *t, ASN1_GENERALIZEDTIME **out)
252+ 	if (t->type != V_ASN1_GENERALIZEDTIME && t->type != V_ASN1_UTCTIME)
253+ 		goto err;
254+ 
255+-	if (t->type != ASN1_time_parse(t->data, t->length, &tm, t->type))
256++	if (t->type != ASN1_time_parse((char *)t->data, t->length, &tm, t->type))
257+ 		goto err;
258+ 
259+ 	if (out == NULL || (agt = *out) == NULL)
260+@@ -460,7 +461,7 @@ ASN1_TIME_cmp_time_t_internal(const ASN1_TIME *s, time_t t2, int mode)
261+ 	 * one of those pervasive things from OpenSSL we must continue with.
262+ 	 */
263+ 
264+-	if (ASN1_time_parse(s->data, s->length, &tm1, mode) == -1)
265++	if (ASN1_time_parse((char *)s->data, s->length, &tm1, mode) == -1)
266+ 		return -2;
267+ 
268+ 	if (!asn1_time_time_t_to_tm(&t2, &tm2))
269+@@ -480,10 +481,10 @@ ASN1_TIME_compare(const ASN1_TIME *t1, const ASN1_TIME *t2)
270+ 	if (t2->type != V_ASN1_UTCTIME && t2->type != V_ASN1_GENERALIZEDTIME)
271+ 		return -2;
272+ 
273+-	if (ASN1_time_parse(t1->data, t1->length, &tm1, t1->type) == -1)
274++	if (ASN1_time_parse((char *)t1->data, t1->length, &tm1, t1->type) == -1)
275+ 		return -2;
276+ 
277+-	if (ASN1_time_parse(t2->data, t2->length, &tm2, t2->type) == -1)
278++	if (ASN1_time_parse((char *)t2->data, t2->length, &tm2, t2->type) == -1)
279+ 		return -2;
280+ 
281+ 	return ASN1_time_tm_cmp(&tm1, &tm2);
282+@@ -511,7 +512,7 @@ ASN1_UTCTIME_check(const ASN1_UTCTIME *d)
283+ {
284+ 	if (d->type != V_ASN1_UTCTIME)
285+ 		return 0;
286+-	return d->type == ASN1_time_parse(d->data, d->length, NULL, d->type);
287++	return d->type == ASN1_time_parse((char *)d->data, d->length, NULL, d->type);
288+ }
289+ LCRYPTO_ALIAS(ASN1_UTCTIME_check);
290+ 
291+@@ -557,7 +558,8 @@ ASN1_GENERALIZEDTIME_check(const ASN1_GENERALIZEDTIME *d)
292+ {
293+ 	if (d->type != V_ASN1_GENERALIZEDTIME)
294+ 		return 0;
295+-	return d->type == ASN1_time_parse(d->data, d->length, NULL, d->type);
296++	return d->type == ASN1_time_parse((char *)d->data, d->length, NULL,
297++	    d->type);
298+ }
299+ LCRYPTO_ALIAS(ASN1_GENERALIZEDTIME_check);
300+ 
301+diff --git a/crypto/bio/b_dump.c b/crypto/bio/b_dump.c
302+index 3f67320..40b09dc 100644
303+--- a/crypto/bio/b_dump.c
304++++ b/crypto/bio/b_dump.c
305+@@ -86,7 +86,7 @@ BIO_dump_indent(BIO *bio, const char *s, int len, int indent)
306+ 
307+ 	if (len < 0)
308+ 		goto err;
309+-	CBS_init(&cbs, s, len);
310++	CBS_init(&cbs, (uint8_t *)s, len);
311+ 
312+ 	if (indent < 0)
313+ 		indent = 0;
314+diff --git a/crypto/bio/bss_mem.c b/crypto/bio/bss_mem.c
315+index 0fa6317..afcd6b2 100644
316+--- a/crypto/bio/bss_mem.c
317++++ b/crypto/bio/bss_mem.c
318+@@ -84,7 +84,7 @@ bio_mem_pending(struct bio_mem *bm)
319+ static uint8_t *
320+ bio_mem_read_ptr(struct bio_mem *bm)
321+ {
322+-	return &bm->buf->data[bm->read_offset];
323++	return (uint8_t *)&bm->buf->data[bm->read_offset];
324+ }
325+ 
326+ static int mem_new(BIO *bio);
327+@@ -349,7 +349,7 @@ mem_gets(BIO *bio, char *out, int out_len)
328+ 		return 0;
329+ 	}
330+ 
331+-	p = bio_mem_read_ptr(bm);
332++	p = (char *)bio_mem_read_ptr(bm);
333+ 	for (i = 0; i < out_max; i++) {
334+ 		if (p[i] == '\n') {
335+ 			i++;
336+diff --git a/crypto/bn/bn_convert.c b/crypto/bn/bn_convert.c
337+index ca5c7d7..60d0c86 100644
338+--- a/crypto/bn/bn_convert.c
339++++ b/crypto/bn/bn_convert.c
340+@@ -253,7 +253,7 @@ BN_asc2bn(BIGNUM **bnp, const char *s)
341+ 	if ((s_len = strlen(s)) == 0)
342+ 		return 0;
343+ 
344+-	CBS_init(&cbs, s, s_len);
345++	CBS_init(&cbs, (uint8_t *)s, s_len);
346+ 
347+ 	/* Handle negative sign. */
348+ 	if (!CBS_peek_u8(&cbs, &v))
349+@@ -365,7 +365,7 @@ BN_bn2dec(const BIGNUM *bn)
350+ 	CBB_cleanup(&cbb);
351+ 	freezero(data, data_len);
352+ 
353+-	return s;
354++	return (char *)s;
355+ }
356+ LCRYPTO_ALIAS(BN_bn2dec);
357+ 
358+@@ -468,7 +468,7 @@ BN_dec2bn(BIGNUM **bnp, const char *s)
359+ 	if ((s_len = strlen(s)) == 0)
360+ 		return 0;
361+ 
362+-	CBS_init(&cbs, s, s_len);
363++	CBS_init(&cbs, (uint8_t *)s, s_len);
364+ 
365+ 	return bn_dec2bn_cbs(bnp, &cbs);
366+ }
367+@@ -669,7 +669,7 @@ BN_hex2bn(BIGNUM **bnp, const char *s)
368+ 	if ((s_len = strlen(s)) == 0)
369+ 		return 0;
370+ 
371+-	CBS_init(&cbs, s, s_len);
372++	CBS_init(&cbs, (uint8_t *)s, s_len);
373+ 
374+ 	return bn_hex2bn_cbs(bnp, &cbs);
375+ }
376+diff --git a/crypto/bn/bn_print.c b/crypto/bn/bn_print.c
377+index cd8b663..6557324 100644
378+--- a/crypto/bn/bn_print.c
379++++ b/crypto/bn/bn_print.c
380+@@ -82,7 +82,7 @@ bn_print_bignum(BIO *bio, const BIGNUM *bn, int indent)
381+ 	if (!bn_bn2hex_nosign(bn, &hex, &hex_len))
382+ 		goto err;
383+ 
384+-	CBS_init(&cbs, hex, hex_len);
385++	CBS_init(&cbs, (uint8_t *)hex, hex_len);
386+ 
387+ 	if (BN_is_negative(bn)) {
388+ 		if (BIO_printf(bio, " (Negative)") <= 0)
389+diff --git a/crypto/evp/e_sm4.c b/crypto/evp/e_sm4.c
390+index cde2f6c..9f8b13e 100644
391+--- a/crypto/evp/e_sm4.c
392++++ b/crypto/evp/e_sm4.c
393+@@ -237,9 +237,11 @@ sm4_ctr_cipher(EVP_CIPHER_CTX *ctx, unsigned char *out, const unsigned char *in,
394+     size_t len)
395+ {
396+ 	EVP_SM4_KEY *key = ((EVP_SM4_KEY *)(ctx)->cipher_data);
397++	unsigned int num;
398+ 
399+ 	CRYPTO_ctr128_encrypt(in, out, len, &key->ks, ctx->iv, ctx->buf,
400+-	    &ctx->num, (block128_f)SM4_encrypt);
401++	    &num, (block128_f)SM4_encrypt);
402++	ctx->num = num;
403+ 	return 1;
404+ }
405+ 
406+diff --git a/crypto/ocsp/ocsp_cl.c b/crypto/ocsp/ocsp_cl.c
407+index 460c1bc..15a70b1 100644
408+--- a/crypto/ocsp/ocsp_cl.c
409++++ b/crypto/ocsp/ocsp_cl.c
410+@@ -410,7 +410,7 @@ OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
411+ 	 * (such as UTCTIME permitted/required by RFC 5280 for certificates)
412+ 	 */
413+ 	/* Check that thisUpdate is valid. */
414+-	if (ASN1_time_parse(thisupd->data, thisupd->length, &tm_this,
415++	if (ASN1_time_parse((char *)thisupd->data, thisupd->length, &tm_this,
416+ 	    V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) {
417+ 		OCSPerror(OCSP_R_ERROR_IN_THISUPDATE_FIELD);
418+ 		return 0;
419+@@ -433,7 +433,7 @@ OCSP_check_validity(ASN1_GENERALIZEDTIME *thisupd,
420+ 		return 1;
421+ 
422+ 	/* Check that nextUpdate is valid. */
423+-	if (ASN1_time_parse(nextupd->data, nextupd->length, &tm_next,
424++	if (ASN1_time_parse((char *)nextupd->data, nextupd->length, &tm_next,
425+ 	    V_ASN1_GENERALIZEDTIME) != V_ASN1_GENERALIZEDTIME) {
426+ 		OCSPerror(OCSP_R_ERROR_IN_NEXTUPDATE_FIELD);
427+ 		return 0;
428+diff --git a/crypto/pkcs7/pk7_attr.c b/crypto/pkcs7/pk7_attr.c
429+index f2e1780..cb6b2e8 100644
430+--- a/crypto/pkcs7/pk7_attr.c
431++++ b/crypto/pkcs7/pk7_attr.c
432+@@ -192,7 +192,7 @@ PKCS7_add0_attrib_signing_time(PKCS7_SIGNER_INFO *si, ASN1_TIME *t)
433+ 	}
434+ 
435+ 	/* RFC 5652, section 11.3 - UTCTime for the years 1950-2049. */
436+-	if (ASN1_time_parse(tm->data, tm->length, NULL, tm->type) == -1)
437++	if (ASN1_time_parse((char *)tm->data, tm->length, NULL, tm->type) == -1)
438+ 		goto err;
439+ 	if (!PKCS7_add_signed_attribute(si, NID_pkcs9_signingTime, tm->type, tm))
440+ 		goto err;
441+diff --git a/crypto/x509/x509_addr.c b/crypto/x509/x509_addr.c
442+index b4ee92a..615375d 100644
443+--- a/crypto/x509/x509_addr.c
444++++ b/crypto/x509/x509_addr.c
445+@@ -1875,7 +1875,7 @@ addr_validate_path_internal(X509_STORE_CTX *ctx, STACK_OF(X509) *chain,
446+ 	X509 *cert = NULL;
447+ 	int depth = -1;
448+ 	int i;
449+-	unsigned int length;
450++	int length;
451+ 	int ret = 1;
452+ 
453+ 	/* We need a non-empty chain to test against. */
454+diff --git a/crypto/x509/x509_constraints.c b/crypto/x509/x509_constraints.c
455+index 0773d2b..673a159 100644
456+--- a/crypto/x509/x509_constraints.c
457++++ b/crypto/x509/x509_constraints.c
458+@@ -347,7 +347,7 @@ x509_constraints_parse_mailbox(CBS *candidate,
459+ 
460+ 	for (i = 0; i < len; i++) {
461+ 		char c;
462+-		if (!CBS_get_u8(&copy, &c))
463++		if (!CBS_get_u8(&copy, (uint8_t *)&c))
464+ 			goto bad;
465+ 		/* non ascii, cr, lf, or nul is never allowed */
466+ 		if (!isascii(c) || c == '\r' || c == '\n' || c == '\0')
467+@@ -445,7 +445,7 @@ x509_constraints_parse_mailbox(CBS *candidate,
468+ 	}
469+ 	if (candidate_local == NULL || candidate_domain == NULL)
470+ 		goto bad;
471+-	CBS_init(&domain_cbs, candidate_domain, strlen(candidate_domain));
472++	CBS_init(&domain_cbs, (uint8_t *)candidate_domain, strlen(candidate_domain));
473+ 	if (!x509_constraints_valid_host(&domain_cbs, 0))
474+ 		goto bad;
475+ 
476+@@ -549,7 +549,7 @@ x509_constraints_uri_host(uint8_t *uri, size_t len, char **hostpart)
477+ 			if (host != NULL)
478+ 				break;
479+ 			/* start after the userinfo part */
480+-			host = uri + i + 1;
481++			host = (char *)uri + i + 1;
482+ 			continue;
483+ 		}
484+ 		/* did we find the end? */
485+@@ -561,8 +561,8 @@ x509_constraints_uri_host(uint8_t *uri, size_t len, char **hostpart)
486+ 	if (hostlen == 0)
487+ 		return 0;
488+ 	if (host == NULL)
489+-		host = authority;
490+-	CBS_init(&host_cbs, host, hostlen);
491++		host = (char *)authority;
492++	CBS_init(&host_cbs, (uint8_t *)host, hostlen);
493+ 	if (!x509_constraints_valid_host(&host_cbs, 1))
494+ 		return 0;
495+ 	if (hostpart != NULL && !CBS_strdup(&host_cbs, hostpart))
496+@@ -648,8 +648,8 @@ x509_constraints_uri(uint8_t *uri, size_t ulen, uint8_t *constraint,
497+ 		*error = X509_V_ERR_UNSUPPORTED_CONSTRAINT_SYNTAX;
498+ 		goto err;
499+ 	}
500+-	ret = x509_constraints_domain(hostpart, strlen(hostpart), constraint,
501+-	    len);
502++	ret = x509_constraints_domain(hostpart, strlen(hostpart),
503++	    (char *)constraint, len);
504+  err:
505+ 	free(hostpart);
506+ 	return ret;
507+@@ -999,7 +999,7 @@ x509_constraints_validate(GENERAL_NAME *constraint,
508+ 	case GEN_DNS:
509+ 		if (!x509_constraints_valid_domain_constraint(&cbs))
510+ 			goto err;
511+-		if ((name->name = strndup(bytes, len)) == NULL) {
512++		if ((name->name = strndup((char *)bytes, len)) == NULL) {
513+ 			error = X509_V_ERR_OUT_OF_MEM;
514+ 			goto err;
515+ 		}
516+@@ -1045,7 +1045,7 @@ x509_constraints_validate(GENERAL_NAME *constraint,
517+ 	case GEN_URI:
518+ 		if (!x509_constraints_valid_domain_constraint(&cbs))
519+ 			goto err;
520+-		if ((name->name = strndup(bytes, len)) == NULL) {
521++		if ((name->name = strndup((char *)bytes, len)) == NULL) {
522+ 			error = X509_V_ERR_OUT_OF_MEM;
523+ 			goto err;
524+ 		}
525+diff --git a/crypto/x509/x509_obj.c b/crypto/x509/x509_obj.c
526+index db1741c..43afeb8 100644
527+--- a/crypto/x509/x509_obj.c
528++++ b/crypto/x509/x509_obj.c
529+@@ -78,13 +78,13 @@ X509_NAME_ENTRY_add_object_cbb(CBB *cbb, const ASN1_OBJECT *aobj)
530+ 	/* Prefer SN over LN, and fall back to textual representation of OID. */
531+ 	if ((nid = OBJ_obj2nid(aobj)) != NID_undef) {
532+ 		if ((str = OBJ_nid2sn(nid)) != NULL)
533+-			return CBB_add_bytes(cbb, str, strlen(str));
534++			return CBB_add_bytes(cbb, (uint8_t *)str, strlen(str));
535+ 		if ((str = OBJ_nid2ln(nid)) != NULL)
536+-			return CBB_add_bytes(cbb, str, strlen(str));
537++			return CBB_add_bytes(cbb, (uint8_t *)str, strlen(str));
538+ 	}
539+ 	if (OBJ_obj2txt(buf, sizeof(buf), aobj, 1) == 0)
540+ 		return 0;
541+-	return CBB_add_bytes(cbb, buf, strlen(buf));
542++	return CBB_add_bytes(cbb, (uint8_t *)buf, strlen(buf));
543+ }
544+ 
545+ static int
546+@@ -183,9 +183,9 @@ X509_NAME_oneline(const X509_NAME *a, char *buf, int len)
547+ 		goto err;
548+ 
549+ 	if (buf == NULL)
550+-		return line;
551++		return (char *)line;
552+ 
553+-	strlcpy(buf, line, len);
554++	strlcpy(buf, (char *)line, len);
555+ 	free(line);
556+ 
557+ 	return buf;
558+diff --git a/crypto/x509/x509_utl.c b/crypto/x509/x509_utl.c
559+index 4be8630..0960fc9 100644
560+--- a/crypto/x509/x509_utl.c
561++++ b/crypto/x509/x509_utl.c
562+@@ -508,7 +508,7 @@ hex_to_string(const unsigned char *buffer, long len)
563+  err:
564+ 	CBB_cleanup(&cbb);
565+ 
566+-	return out;
567++	return (char *)out;
568+ }
569+ LCRYPTO_ALIAS(hex_to_string);
570+ 
571+@@ -573,7 +573,7 @@ string_to_hex(const char *str, long *len)
572+ 		goto err;
573+ 	}
574+ 
575+-	CBS_init(&cbs, str, strlen(str));
576++	CBS_init(&cbs, (uint8_t *)str, strlen(str));
577+ 	while (CBS_len(&cbs) > 0) {
578+ 		/*
579+ 		 * Skipping only a single colon between two pairs of digits
580+@@ -817,7 +817,7 @@ equal_nocase(const unsigned char *pattern, size_t pattern_len,
581+ 	skip_prefix(&pattern, &pattern_len, subject, subject_len, flags);
582+ 	if (pattern_len != subject_len)
583+ 		return 0;
584+-	return (strncasecmp(pattern, subject, pattern_len) == 0);
585++	return (strncasecmp((char *)pattern, (char *)subject, pattern_len) == 0);
586+ }
587+ 
588+ /* Compare using strncmp. */
589+@@ -832,7 +832,7 @@ equal_case(const unsigned char *pattern, size_t pattern_len,
590+ 	skip_prefix(&pattern, &pattern_len, subject, subject_len, flags);
591+ 	if (pattern_len != subject_len)
592+ 		return 0;
593+-	return (strncmp(pattern, subject, pattern_len) == 0);
594++	return (strncmp((char *)pattern, (char *)subject, pattern_len) == 0);
595+ }
596+ 
597+ /*
598+diff --git a/crypto/x509/x509_verify.c b/crypto/x509/x509_verify.c
599+index f25e2b3..c52be9e 100644
600+--- a/crypto/x509/x509_verify.c
601++++ b/crypto/x509/x509_verify.c
602+@@ -55,7 +55,8 @@ x509_verify_asn1_time_to_time_t(const ASN1_TIME *atime, int notAfter,
603+ 	if (atime == NULL)
604+ 		return 0;
605+ 
606+-	type = ASN1_time_parse(atime->data, atime->length, &tm, atime->type);
607++	type = ASN1_time_parse((char *)atime->data, atime->length, &tm,
608++	    atime->type);
609+ 	if (type == -1)
610+ 		return 0;
611+ 
612+diff --git a/crypto/x509/x509name.c b/crypto/x509/x509name.c
613+index 9a582d3..20498dd 100644
614+--- a/crypto/x509/x509name.c
615++++ b/crypto/x509/x509name.c
616+@@ -107,7 +107,8 @@ X509_NAME_get_text_by_OBJ(X509_NAME *name, const ASN1_OBJECT *obj, char *buf,
617+ 		goto err;
618+ 	/* We still support the "pass NULL to find out how much" API */
619+ 	if (buf != NULL) {
620+-		if (len <= 0 || !CBS_write_bytes(&cbs, buf, len - 1, NULL))
621++		if (len <= 0 || !CBS_write_bytes(&cbs, (uint8_t *)buf,
622++		    len - 1, NULL))
623+ 			goto err;
624+ 		/* It must be a C string */
625+ 		buf[text_len] = '\0';
626+diff --git a/ssl/s3_lib.c b/ssl/s3_lib.c
627+index 86b32ae..e760c0b 100644
628+--- a/ssl/s3_lib.c
629++++ b/ssl/s3_lib.c
630+@@ -1548,7 +1548,7 @@ _SSL_set_tlsext_host_name(SSL *s, const char *name)
631+ 	if (name == NULL)
632+ 		return 1;
633+ 
634+-	CBS_init(&cbs, name, strlen(name));
635++	CBS_init(&cbs, (uint8_t *)name, strlen(name));
636+ 
637+ 	if (!tlsext_sni_is_valid_hostname(&cbs, &is_ip)) {
638+ 		SSLerror(s, SSL_R_SSL3_EXT_INVALID_SERVERNAME);
639+diff --git a/ssl/ssl_clnt.c b/ssl/ssl_clnt.c
640+index 0d3dcf7..9a59d98 100644
641+--- a/ssl/ssl_clnt.c
642++++ b/ssl/ssl_clnt.c
643+@@ -2330,7 +2330,7 @@ ssl3_send_client_change_cipher_spec(SSL *s)
644+ 	memset(&cbb, 0, sizeof(cbb));
645+ 
646+ 	if (s->s3->hs.state == SSL3_ST_CW_CHANGE_A) {
647+-		if (!CBB_init_fixed(&cbb, s->init_buf->data,
648++		if (!CBB_init_fixed(&cbb, (uint8_t *)s->init_buf->data,
649+ 		    s->init_buf->length))
650+ 			goto err;
651+ 		if (!CBB_add_u8(&cbb, SSL3_MT_CCS))
652+diff --git a/ssl/ssl_lib.c b/ssl/ssl_lib.c
653+index 630724e..32ab533 100644
654+--- a/ssl/ssl_lib.c
655++++ b/ssl/ssl_lib.c
656+@@ -2004,12 +2004,12 @@ SSL_export_keying_material(SSL *s, unsigned char *out, size_t out_len,
657+ 			context = NULL;
658+ 			context_len = 0;
659+ 		}
660+-		return tls13_exporter(s->tls13, label, label_len, context,
661+-		    context_len, out, out_len);
662++		return tls13_exporter(s->tls13, (uint8_t *)label, label_len,
663++		    context, context_len, out, out_len);
664+ 	}
665+ 
666+-	return tls12_exporter(s, label, label_len, context, context_len,
667+-	    use_context, out, out_len);
668++	return tls12_exporter(s, (uint8_t *)label, label_len, context,
669++	    context_len, use_context, out, out_len);
670+ }
671+ LSSL_ALIAS(SSL_export_keying_material);
672+ 
673+diff --git a/ssl/ssl_srvr.c b/ssl/ssl_srvr.c
674+index db4ba38..4dfaaf5 100644
675+--- a/ssl/ssl_srvr.c
676++++ b/ssl/ssl_srvr.c
677+@@ -2371,7 +2371,7 @@ ssl3_send_server_change_cipher_spec(SSL *s)
678+ 	memset(&cbb, 0, sizeof(cbb));
679+ 
680+ 	if (s->s3->hs.state == SSL3_ST_SW_CHANGE_A) {
681+-		if (!CBB_init_fixed(&cbb, s->init_buf->data,
682++		if (!CBB_init_fixed(&cbb, (uint8_t *)s->init_buf->data,
683+ 		    s->init_buf->length))
684+ 			goto err;
685+ 		if (!CBB_add_u8(&cbb, SSL3_MT_CCS))
686+diff --git a/ssl/ssl_tlsext.c b/ssl/ssl_tlsext.c
687+index 311c29b..e1c9b3c 100644
688+--- a/ssl/ssl_tlsext.c
689++++ b/ssl/ssl_tlsext.c
690+@@ -808,7 +808,8 @@ tlsext_sni_server_process(SSL *s, uint16_t msg_type, CBS *cbs, int *alert)
691+ 			*alert = SSL_AD_UNRECOGNIZED_NAME;
692+ 			goto err;
693+ 		}
694+-		if (!CBS_mem_equal(&host_name, s->session->tlsext_hostname,
695++		if (!CBS_mem_equal(&host_name,
696++		    (uint8_t *)s->session->tlsext_hostname,
697+ 		    strlen(s->session->tlsext_hostname))) {
698+ 			*alert = SSL_AD_UNRECOGNIZED_NAME;
699+ 			goto err;
700+diff --git a/ssl/ssl_txt.c b/ssl/ssl_txt.c
701+index 4ed76c9..1ad3b92 100644
702+--- a/ssl/ssl_txt.c
703++++ b/ssl/ssl_txt.c
704+@@ -170,8 +170,8 @@ SSL_SESSION_print(BIO *bp, const SSL_SESSION *x)
705+ 	if (x->tlsext_tick != NULL) {
706+ 		if (BIO_puts(bp, "\n    TLS session ticket:\n") <= 0)
707+ 			goto err;
708+-		if (BIO_dump_indent(bp, x->tlsext_tick, x->tlsext_ticklen,
709+-		    4) <= 0)
710++		if (BIO_dump_indent(bp, (char *)x->tlsext_tick,
711++		    x->tlsext_ticklen, 4) <= 0)
712+ 			goto err;
713+ 	}
714+ 
715+diff --git a/ssl/t1_lib.c b/ssl/t1_lib.c
716+index 57cd180..9797aab 100644
717+--- a/ssl/t1_lib.c
718++++ b/ssl/t1_lib.c
719+@@ -1018,6 +1018,7 @@ tls_decrypt_ticket(SSL *s, CBS *ticket, int *alert, SSL_SESSION **psess)
720+ 	EVP_CIPHER_CTX *cctx = NULL;
721+ 	SSL_CTX *tctx = s->initial_ctx;
722+ 	int slen, hlen, iv_len;
723++	unsigned int hlenu;
724+ 	int alert_desc = SSL_AD_INTERNAL_ERROR;
725+ 	int ret = TLS1_TICKET_FATAL_ERROR;
726+ 
727+@@ -1112,8 +1113,9 @@ tls_decrypt_ticket(SSL *s, CBS *ticket, int *alert, SSL_SESSION **psess)
728+ 	if (HMAC_Update(hctx, CBS_data(&ticket_encdata),
729+ 	    CBS_len(&ticket_encdata)) <= 0)
730+ 		goto err;
731+-	if (HMAC_Final(hctx, hmac, &hlen) <= 0)
732++	if (HMAC_Final(hctx, hmac, &hlenu) <= 0)
733+ 		goto err;
734++	hlen = hlenu;
735+ 
736+ 	if (!CBS_mem_equal(&ticket_hmac, hmac, hlen))
737+ 		goto derr;
738+diff --git a/ssl/tls13_client.c b/ssl/tls13_client.c
739+index 901b38f..414c9cb 100644
740+--- a/ssl/tls13_client.c
741++++ b/ssl/tls13_client.c
742+@@ -656,7 +656,7 @@ tls13_server_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
743+ 	    sizeof(tls13_cert_verify_pad)))
744+ 		goto err;
745+ 	if (!CBB_add_bytes(&cbb, tls13_cert_server_verify_context,
746+-	    strlen(tls13_cert_server_verify_context)))
747++	    strlen((char *)tls13_cert_server_verify_context)))
748+ 		goto err;
749+ 	if (!CBB_add_u8(&cbb, 0))
750+ 		goto err;
751+@@ -710,7 +710,7 @@ int
752+ tls13_server_finished_recv(struct tls13_ctx *ctx, CBS *cbs)
753+ {
754+ 	struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
755+-	struct tls13_secret context = { .data = "", .len = 0 };
756++	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
757+ 	struct tls13_secret finished_key;
758+ 	uint8_t transcript_hash[EVP_MAX_MD_SIZE];
759+ 	size_t transcript_hash_len;
760+@@ -932,7 +932,7 @@ tls13_client_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
761+ 	    sizeof(tls13_cert_verify_pad)))
762+ 		goto err;
763+ 	if (!CBB_add_bytes(&sig_cbb, tls13_cert_client_verify_context,
764+-	    strlen(tls13_cert_client_verify_context)))
765++	    strlen((char *)tls13_cert_client_verify_context)))
766+ 		goto err;
767+ 	if (!CBB_add_u8(&sig_cbb, 0))
768+ 		goto err;
769+@@ -993,7 +993,7 @@ int
770+ tls13_client_finished_send(struct tls13_ctx *ctx, CBB *cbb)
771+ {
772+ 	struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
773+-	struct tls13_secret context = { .data = "", .len = 0 };
774++	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
775+ 	struct tls13_secret finished_key = { .data = NULL, .len = 0 };
776+ 	uint8_t transcript_hash[EVP_MAX_MD_SIZE];
777+ 	size_t transcript_hash_len;
778+diff --git a/ssl/tls13_key_schedule.c b/ssl/tls13_key_schedule.c
779+index 05bcf0f..19afc79 100644
780+--- a/ssl/tls13_key_schedule.c
781++++ b/ssl/tls13_key_schedule.c
782+@@ -160,8 +160,8 @@ tls13_hkdf_expand_label(struct tls13_secret *out, const EVP_MD *digest,
783+     const struct tls13_secret *secret, const char *label,
784+     const struct tls13_secret *context)
785+ {
786+-	return tls13_hkdf_expand_label_with_length(out, digest, secret, label,
787+-	    strlen(label), context);
788++	return tls13_hkdf_expand_label_with_length(out, digest, secret,
789++	    (uint8_t *)label, strlen(label), context);
790+ }
791+ 
792+ int
793+@@ -185,7 +185,7 @@ tls13_hkdf_expand_label_with_length(struct tls13_secret *out,
794+ 		goto err;
795+ 	if (!CBB_add_u8_length_prefixed(&cbb, &child))
796+ 		goto err;
797+-	if (!CBB_add_bytes(&child, tls13_plabel, strlen(tls13_plabel)))
798++	if (!CBB_add_bytes(&child, (uint8_t *)tls13_plabel, strlen(tls13_plabel)))
799+ 		goto err;
800+ 	if (!CBB_add_bytes(&child, label, label_len))
801+ 		goto err;
802+@@ -362,7 +362,7 @@ tls13_derive_application_secrets(struct tls13_secrets *secrets,
803+ int
804+ tls13_update_client_traffic_secret(struct tls13_secrets *secrets)
805+ {
806+-	struct tls13_secret context = { .data = "", .len = 0 };
807++	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
808+ 
809+ 	if (!secrets->init_done || !secrets->early_done ||
810+ 	    !secrets->handshake_done || !secrets->schedule_done)
811+@@ -376,7 +376,7 @@ tls13_update_client_traffic_secret(struct tls13_secrets *secrets)
812+ int
813+ tls13_update_server_traffic_secret(struct tls13_secrets *secrets)
814+ {
815+-	struct tls13_secret context = { .data = "", .len = 0 };
816++	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
817+ 
818+ 	if (!secrets->init_done || !secrets->early_done ||
819+ 	    !secrets->handshake_done || !secrets->schedule_done)
820+@@ -423,7 +423,7 @@ tls13_exporter(struct tls13_ctx *ctx, const uint8_t *label, size_t label_len,
821+ 
822+ 	/* In TLSv1.3 no context is equivalent to an empty context. */
823+ 	if (context_value == NULL) {
824+-		context_value = "";
825++		context_value = (uint8_t *)"";
826+ 		context_value_len = 0;
827+ 	}
828+ 
829+diff --git a/ssl/tls13_legacy.c b/ssl/tls13_legacy.c
830+index 6c33ecc..481ca9e 100644
831+--- a/ssl/tls13_legacy.c
832++++ b/ssl/tls13_legacy.c
833+@@ -360,7 +360,7 @@ tls13_use_legacy_stack(struct tls13_ctx *ctx)
834+ 	tls13_handshake_msg_data(ctx->hs_msg, &cbs);
835+ 	if (!BUF_MEM_grow_clean(s->init_buf, CBS_len(&cbs)))
836+ 		goto err;
837+-	if (!CBS_write_bytes(&cbs, s->init_buf->data,
838++	if (!CBS_write_bytes(&cbs, (uint8_t *)s->init_buf->data,
839+ 	    s->init_buf->length, NULL))
840+ 		goto err;
841+ 
842+diff --git a/ssl/tls13_lib.c b/ssl/tls13_lib.c
843+index c3470b2..5d9f159 100644
844+--- a/ssl/tls13_lib.c
845++++ b/ssl/tls13_lib.c
846+@@ -378,7 +378,8 @@ tls13_new_session_ticket_recv(struct tls13_ctx *ctx, CBS *cbs)
847+ 	uint32_t ticket_lifetime, ticket_age_add;
848+ 	CBS ticket_nonce, ticket;
849+ 	SSL_SESSION *sess = NULL;
850+-	int alert, session_id_length;
851++	int alert;
852++	unsigned int session_id_length;
853+ 	ssize_t ret = 0;
854+ 
855+ 	memset(&nonce, 0, sizeof(nonce));
856+diff --git a/ssl/tls13_record_layer.c b/ssl/tls13_record_layer.c
857+index f5604ad..9bdd61c 100644
858+--- a/ssl/tls13_record_layer.c
859++++ b/ssl/tls13_record_layer.c
860+@@ -467,7 +467,7 @@ static int
861+ tls13_record_layer_set_traffic_key(const EVP_AEAD *aead, const EVP_MD *hash,
862+     struct tls13_record_protection *rp, struct tls13_secret *traffic_key)
863+ {
864+-	struct tls13_secret context = { .data = "", .len = 0 };
865++	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
866+ 	struct tls13_secret key = { .data = NULL, .len = 0 };
867+ 	int ret = 0;
868+ 
869+diff --git a/ssl/tls13_server.c b/ssl/tls13_server.c
870+index 650fd13..184b3d3 100644
871+--- a/ssl/tls13_server.c
872++++ b/ssl/tls13_server.c
873+@@ -728,7 +728,7 @@ tls13_server_certificate_verify_send(struct tls13_ctx *ctx, CBB *cbb)
874+ 	    sizeof(tls13_cert_verify_pad)))
875+ 		goto err;
876+ 	if (!CBB_add_bytes(&sig_cbb, tls13_cert_server_verify_context,
877+-	    strlen(tls13_cert_server_verify_context)))
878++	    strlen((char *)tls13_cert_server_verify_context)))
879+ 		goto err;
880+ 	if (!CBB_add_u8(&sig_cbb, 0))
881+ 		goto err;
882+@@ -783,7 +783,7 @@ int
883+ tls13_server_finished_send(struct tls13_ctx *ctx, CBB *cbb)
884+ {
885+ 	struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
886+-	struct tls13_secret context = { .data = "", .len = 0 };
887++	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
888+ 	struct tls13_secret finished_key = { .data = NULL, .len = 0 } ;
889+ 	uint8_t transcript_hash[EVP_MAX_MD_SIZE];
890+ 	size_t transcript_hash_len;
891+@@ -840,7 +840,7 @@ int
892+ tls13_server_finished_sent(struct tls13_ctx *ctx)
893+ {
894+ 	struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
895+-	struct tls13_secret context = { .data = "", .len = 0 };
896++	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
897+ 
898+ 	/*
899+ 	 * Derive application traffic keys.
900+@@ -959,7 +959,7 @@ tls13_client_certificate_verify_recv(struct tls13_ctx *ctx, CBS *cbs)
901+ 	    sizeof(tls13_cert_verify_pad)))
902+ 		goto err;
903+ 	if (!CBB_add_bytes(&cbb, tls13_cert_client_verify_context,
904+-	    strlen(tls13_cert_client_verify_context)))
905++	    strlen((char *)tls13_cert_client_verify_context)))
906+ 		goto err;
907+ 	if (!CBB_add_u8(&cbb, 0))
908+ 		goto err;
909+@@ -1020,7 +1020,7 @@ int
910+ tls13_client_finished_recv(struct tls13_ctx *ctx, CBS *cbs)
911+ {
912+ 	struct tls13_secrets *secrets = ctx->hs->tls13.secrets;
913+-	struct tls13_secret context = { .data = "", .len = 0 };
914++	struct tls13_secret context = { .data = (uint8_t *)"", .len = 0 };
915+ 	struct tls13_secret finished_key;
916+ 	uint8_t *verify_data = NULL;
917+ 	size_t verify_data_len;
918+-- 
919+2.49.0
920+